# How to protect attributes from being updated?

**URL:** <https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828>\
**Category:** rubyonrails-talk\
**Created:** [January 26, 2007, 4:28pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828 "2007-01-26T16:28:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![gmarik](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gmarik](https://discuss.rubyonrails.org/u/gmarik)\
**Post date:** [January 26, 2007, 4:28pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/1 "2007-01-26T16:28:51Z")

</div>

Hi! I'm new to Rails! Rails rox!

1 quesion so far: I have :email attribute in User model. I dont' want :email to allow to be updated.

How do i do this with Rails? Do I have to implement required validation manually?

Thanks!

---

<div class="post-metadata">

**Author:** ![Zack\_Chandler](https://avatars.discourse-cdn.com/v4/letter/z/a698b9/32.png) [@Zack\_Chandler](https://discuss.rubyonrails.org/u/Zack_Chandler)\
**Post date:** [January 27, 2007, 2:55am UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/2 "2007-01-27T02:55:25Z")

</div>

classs User \< ActiveRecord::Base &nbsp;&nbsp;attr\_protected :email &nbsp;&nbsp;... end

Docs: [http://caboo.se/doc/classes/ActiveRecord/Base.html#M006884](http://caboo.se/doc/classes/ActiveRecord/Base.html#M006884)

---

<div class="post-metadata">

**Author:** ![gmarik](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gmarik](https://discuss.rubyonrails.org/u/gmarik)\
**Post date:** [January 29, 2007, 12:55pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/3 "2007-01-29T12:55:02Z")

</div>

Thanks Zak, but it's not what i need. I don't want it to be UPDATED(ie Edit) And i need this attribute, when object is being CREATED(ie New).

So it could look like this(the code isnt' valid): .... attr\_accessible :name, :description attr\_accessible :email if new\_record? ....

Any ideas? Thanks!

---

<div class="post-metadata">

**Author:** ![RSL](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@RSL](https://discuss.rubyonrails.org/u/RSL)\
**Post date:** [January 29, 2007, 1:46pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/4 "2007-01-29T13:46:11Z")

</div>

I’d say you should do something like…

attr\_accessor :address attr\_protected :email

def before\_create self.email = address end

and use User#address in the form.

RSL

---

<div class="post-metadata">

**Author:** ![gmarik](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gmarik](https://discuss.rubyonrails.org/u/gmarik)\
**Post date:** [January 30, 2007, 10:27am UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/5 "2007-01-30T10:27:58Z")

</div>

Nice trick! Thanks Russell!

---

<div class="post-metadata">

**Author:** ![Isak](https://avatars.discourse-cdn.com/v4/letter/i/ac91a4/32.png) [@Isak](https://discuss.rubyonrails.org/u/Isak)\
**Post date:** [January 30, 2007, 5:37pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/6 "2007-01-30T17:37:30Z")

</div>

> Thanks Zak, but it's not what i need. I don't want it to be UPDATED(ie Edit) And i need this attribute, when object is being CREATED(ie New).
> 
> So it could look like this(the code isnt' valid): .... attr\_accessible :name, :description attr\_accessible :email if new\_record? ....

attr\_readonly -- see \<[http://dev.rubyonrails.org/ticket/6896&gt](http://dev.rubyonrails.org/ticket/6896&gt); -- may be what you're looking for? I'm not overly optimistic about our chances of getting it added, though..

Another option for emulating read only attributes could be a before\_save callback that; locks the row (select for update), then load the model into some variable and then copy the field in question into self.

I'm not sure Russel's approach will work; say you load the model, the row/column is changed by some other process, and then you save your old model again overwriting the new value.

I'd just go with attr\_protected and set that field individually on creation, if this is all you need.

Isak

---

<div class="post-metadata">

**Author:** ![gmarik](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gmarik](https://discuss.rubyonrails.org/u/gmarik)\
**Post date:** [January 31, 2007, 1:05pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/7 "2007-01-31T13:05:14Z")

</div>

Well, for now Russel's approach is just fine.

The issue with other processes modifying attribute directly can be avoided by putting attr\_reader for :email, so it' won't be changed from outside. Right?

Thanks!

---

<div class="post-metadata">

**Author:** ![Isak](https://avatars.discourse-cdn.com/v4/letter/i/ac91a4/32.png) [@Isak](https://discuss.rubyonrails.org/u/Isak)\
**Post date:** [January 31, 2007, 6:55pm UTC](https://discuss.rubyonrails.org/t/how-to-protect-attributes-from-being-updated/7828/8 "2007-01-31T18:55:00Z")

</div>

> Well, for now Russel's approach is just fine.
> 
> The issue with other processes modifying attribute directly can be avoided by putting attr\_reader for :email, so it' won't be changed from outside. Right?

If your app is the only thing writing to that particular field, protecting the attribute in your model - either with attr\_protected, an overridden mutator, or the dummy attribute idea - is probably enough, yea.

Isak